COSESAI

未分类

PKCE Code Verifier & Challenge Generator Field Guide: When Three Modes and Four Entropy Tiers Decide Whether the OAuth Handshake Survives a Network Sniffer

By xiezixing 2026年10月14日

PKCE Code Verifier & Challenge Generator Field Guide: When Three Modes and Four Entropy Tiers…

未分类

Atbash Cipher Field Guide: When the Simplest Substitution Is Its Own Inverse

By xiezixing 2026年10月8日

Atbash is the simplest substitution cipher in the alphabet: encode and decode are the same operation because the 26-letter mirror is its own inverse. Field guide covers the position formula, boundary cases, and practical uses.

未分类

OAuth PKCE Field Guide: When the code_verifier and the intercepted code sit on the same wire

By xiezixing 2026年10月7日

The defense against an intercepted OAuth authorization code isn’t a clever rate-limit or a long-lived…

未分类

TOTP and HOTP Field Guide: When Your 2FA Stops Needing a Phone

By xiezixing 2026年10月6日

The RFC 6238 test seed is JBSWY3DPEHPK3PXP and the code your phone shows at this…

未分类

Security Headers Checker Field Guide: When HSTS, CSP, and the Order of Operations Decide Whether a Downgrade Attack Lands

By xiezixing 2026年10月6日

Security headers are not a paper exercise. Every HTTP response that ships without HSTS, a…

未分类

Windows PE / Linux ELF / Mach-O Binary Header Inspector Field Guide

By xiezixing 2026年10月5日

Most binary-file bugs hide in the headers your IDE never opens. This field guide reads PE-COFF, ELF, and Mach-O headers end to end with cross-architecture annotations.

未分类

Text Hash Generator Field Guide: When MD5 Collides With Your Build, the SHA-256 Fingerprint Is the One That Saves You

By xiezixing 2026年9月9日

MD5 still ships in production code, but the day it collides with your build, the…

Image Steganography Embed & Detect field guide: when nine flags decide whether your hidden message survives a chi-square sweep, or surfaces in the first 64 windows

By xiezixing 2026年9月8日

Steganography is what happens when encryption is not enough — or when it is the…

未分类

URL Safety Checker Field Guide: When Punycode, IDN Homographs, and Embedded Credentials Hide Behind a ‘Safe-Looking’ Domain

By xiezixing 2026年8月29日

Most phishing URLs don’t look obviously malicious — they look like every other short link…

未分类

JWT Inspector & Verifier Field Guide: When Decoding Is Not Verifying

By xiezixing 2026年8月28日

Decode, verify, and rehearse the algorithm-confusion attack on JWTs. The seven claims that decide whether your verifier admits or rejects a token.